Cisco 300-720 SESA key terms

A configuration object on the Email Security Appliance that binds a service to an interface and IP address, defining which hosts may connect, which protocols are accepted, and how mail arriving on that path is handled.

A listener that accepts Simple Mail Transfer Protocol connections from external, untrusted hosts on the internet. It usually enforces recipient validation, host access rules, and stricter filtering than an internal listener.

An ordered set of sender groups on a listener that maps connecting hosts to a policy. Each entry can allow, reject, throttle, or require authentication, and the first matching entry is applied.

A named collection of remote hosts, IP ranges, or verified sender identities used as a matching condition in the Host Access Table, so one mail flow policy can apply to many connecting systems.

A named set of connection limits and behaviors applied to a sender group, covering maximum concurrent connections, recipients per message, message size, and whether authentication or transport layer security is required.

A protective mechanism that limits how many simultaneous connections a host or sender group may open, and how many messages it may send per hour, to blunt directory harvest and denial-of-service attempts.

A feature that detects a sender probing for valid recipients by counting invalid recipient addresses within a time window; once the threshold is crossed, further recipients from that host are rejected.

The process of confirming that a recipient address exists before accepting a message, using an LDAP query or a local recipient table, so invalid addresses are refused during the SMTP conversation.

A validation method in which the appliance opens a separate SMTP connection to an upstream server to ask whether a recipient exists, instead of querying a directory directly.

A logical grouping of listeners and IP addresses that lets the appliance present different hostnames or IP identities in its SMTP banner and outbound connections, and receive mail on distinct addresses.

The greeting text a mail server sends when a client connects. On the appliance it can be customized per listener or virtual gateway, and it influences how remote systems and reputation services identify the host.

A centralized log of every message handled by the appliance, recording sender, recipient, subject, verdict, and delivery status, searchable by administrators to trace the path and fate of a message.

Detailed per-connection and per-message log records written by the appliance, including SMTP conversation events, filtering verdicts, and delivery results, used to diagnose mail flow problems.

A troubleshooting tool that records raw network traffic on a chosen interface, filtered by host or port, so administrators can inspect the actual SMTP dialogue between systems.

A command-line utility on the appliance that captures live packet data for protocol analysis; its output can be written to a file and reviewed or sent to support for deeper diagnosis.

A rule that inspects the envelope, headers, and connection metadata at a defined point in the mail pipeline and can drop, quarantine, redirect, or tag a message before content filters run.

A rule that examines message body, attachments, and headers for specified conditions and then applies actions such as quarantine, drop, add header, or send notification.

A policy engine that classifies outbound content using predefined or custom patterns, such as credit card numbers or identifiers, and then enforces actions like encryption, quarantine, or blocking.

A holding area where the appliance stores messages that a policy has flagged rather than delivered. Administrators or end users can review, release, or delete held messages.

A per-recipient store for messages classified as spam, accessible through a web interface or email digest, where users release legitimate mail and administrators set retention and thresholds.

A quarantine used by content and message filters to hold messages that match administrative rules, distinct from the spam quarantine and typically reviewed by administrators rather than end users.

The appliance's layered spam detection, combining reputation analysis, content heuristics, and rules, which assigns a spam verdict and score to each message before policy actions apply.

A numeric score assigned to a message by the anti-spam engine. Thresholds map score ranges to actions such as tagging the subject, adding headers, quarantining, or dropping the message.

A named configuration that defines spam thresholds and the resulting actions, and is applied to users, senders, or domains through mail policies so different groups receive different treatment.

A reputation rating for the sending IP address, derived from observed mail volume and complaint history, used as an input to spam and connection decisions in the Host Access Table.

A filtering stage that evaluates the sending host's reputation and behavior before full message content is scanned, allowing the appliance to reject or throttle suspicious senders early.

Inspection of message bodies and attachments using one or more virus engines, with configurable actions per engine such as dropping, quarantining, or cleaning infected messages.

A proactive defense that uses global threat telemetry to detect emerging virus and phishing campaigns, quarantining suspicious messages during the window before signature-based engines can react.

A dedicated quarantine that holds messages flagged by outbreak rules, where administrators can review, release, or delete them and where released messages are rescanned before delivery.

A cloud-assisted check that hashes attachments and URLs and compares them against a global database of known malicious and unknown files, returning a verdict used for policy decisions.

Submission of suspicious attachments to a sandbox environment where behavior is observed, producing a verdict that the appliance uses to block or allow the message.

A DNS-based email authentication method in which a domain publishes the hosts authorized to send its mail, letting receivers compare the connecting IP against that published list.

A cryptographic authentication method that attaches a digital signature to outgoing messages using a domain key, letting receivers verify that the message was authorized and not altered in transit.

A policy framework that ties SPF and DKIM results to the From domain, tells receivers how to handle failures, and can request aggregate or forensic reports about authentication outcomes.

A configuration step in which the appliance proves control of a domain, typically via a DNS record, before it will sign outbound mail or apply authentication-based policies for that domain.

Protection of message content so only intended recipients can read it, applied by the appliance through TLS transport, S/MIME, or a hosted encryption service based on policy or keyword triggers.

Opportunistic or required encryption of the SMTP session between servers, configured on listeners and destination controls to protect mail in transit and satisfy policy requirements.

A rule that determines when outbound messages must be encrypted, based on content filters, recipient domains, or keywords, and which encryption profile is applied to them.

A per-recipient or per-sender configuration that assigns anti-spam, anti-virus, outbreak, content filter, and other settings, allowing different user groups to be treated differently.

A directory query the appliance runs during the SMTP conversation to verify that a recipient address exists, optionally returning routing or policy attributes for that user.

An upstream mail server to which the appliance forwards accepted messages for final delivery, configured per listener or domain when the appliance is not the final destination.